Eclipse and STMicroelectronics vulnerabilities

Summary: Cisco Talos disclosed three vulnerabilities in Eclipse ThreadX and four in STMicroelectronics' X-CUBE-AZRTOS fork of ThreadX, all found by Talos researcher Kelly Patterson and since patched by the vendors. The flaws include a denial-of-service bug in the NetX HTTP server, two integer underflows in HTTP PUT request handling, and a buffer overflow in the FileX Internal RAM interface of X-CUBE-AZRTOS-WL 2.0.0 that a crafted set of network packets can use to reach code execution.
Key Takeaway: One of these bugs, CVE-2024-45064, turns a sequence of network packets into code execution on STMicroelectronics hardware running X-CUBE-AZRTOS-WL 2.0.0 - a reminder that the embedded stack under your devices carries remotely triggerable flaws, not just the applications on top of it.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-45064 CVE-2024-50384 CVE-2024-50385 CVE-2024-50594 CVE-2024-50595 CVE-2024-50596 CVE-2024-50597 CVE-2025-0726 CVE-2025-0727 CVE-2025-0728 CVE-2025-2258 CVE-2025-2259 CVE-2025-2260
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026